124 lines
4.0 KiB
Go
124 lines
4.0 KiB
Go
package auth
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"fmt"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func basicHeader(payload string) string {
|
|
return "Basic " + base64.StdEncoding.EncodeToString([]byte(payload))
|
|
}
|
|
|
|
func TestParseBasicAuth(t *testing.T) {
|
|
cases := []struct {
|
|
name, header, username, password string
|
|
want error
|
|
}{
|
|
{name: "standard", header: basicHeader("user:pass"), username: "user", password: "pass"},
|
|
{name: "empty password", header: basicHeader("user:"), username: "user"},
|
|
{name: "empty username", header: basicHeader(":pass"), password: "pass"},
|
|
{name: "colon in password", header: basicHeader("user:pa:ss"), username: "user", password: "pa:ss"},
|
|
{name: "unicode", header: basicHeader("üser:pässwörd"), username: "üser", password: "pässwörd"},
|
|
{name: "separator only", header: basicHeader(":")},
|
|
|
|
{name: "missing scheme", header: "Invalid header", want: ErrAuthInvalidBasicFormat},
|
|
{name: "no space", header: "Basic", want: ErrAuthInvalidBasicFormat},
|
|
{name: "empty header", header: "", want: ErrAuthInvalidBasicFormat},
|
|
// ☢ RFC 7235 auth-scheme is case-insensitive; matching here is not
|
|
{name: "lowercase scheme", header: "basic dXNlcjpwYXNz", want: ErrAuthInvalidBasicFormat},
|
|
{name: "bad base64", header: "Basic not-base64!", want: ErrAuthInvalidBasicEncoding},
|
|
{name: "no colon", header: basicHeader("no-colon"), want: ErrAuthInvalidBasicCreds},
|
|
{name: "empty payload", header: "Basic ", want: ErrAuthInvalidBasicCreds},
|
|
}
|
|
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
username, password, err := ParseBasicAuth(tc.header)
|
|
if tc.want != nil {
|
|
errIs(t, err, tc.want, tc.name)
|
|
eq(t, username, "", "username on failure")
|
|
eq(t, password, "", "password on failure")
|
|
return
|
|
}
|
|
noErr(t, err, tc.name)
|
|
eq(t, username, tc.username, "username")
|
|
eq(t, password, tc.password, "password")
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestParseBearerToken(t *testing.T) {
|
|
cases := []struct {
|
|
name, header, token string
|
|
want error
|
|
}{
|
|
{name: "standard", header: "Bearer test-token-xyz", token: "test-token-xyz"},
|
|
{name: "embedded space", header: "Bearer a b", token: "a b"},
|
|
{name: "trailing space", header: "Bearer x ", token: "x "},
|
|
|
|
{name: "empty token", header: "Bearer ", want: ErrAuthEmptyBearerToken},
|
|
{name: "missing scheme", header: "Invalid header", want: ErrAuthInvalidBearerFormat},
|
|
{name: "lowercase scheme", header: "bearer x", want: ErrAuthInvalidBearerFormat},
|
|
{name: "no space", header: "Bearer", want: ErrAuthInvalidBearerFormat},
|
|
{name: "empty header", header: "", want: ErrAuthInvalidBearerFormat},
|
|
}
|
|
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
token, err := ParseBearerToken(tc.header)
|
|
if tc.want != nil {
|
|
errIs(t, err, tc.want, tc.name)
|
|
eq(t, token, "", "token on failure")
|
|
return
|
|
}
|
|
noErr(t, err, tc.name)
|
|
eq(t, token, tc.token, "token")
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestExtractAuthType(t *testing.T) {
|
|
cases := map[string]string{
|
|
"Basic dXNlcjpwYXNz": "Basic",
|
|
"Bearer token": "Bearer",
|
|
"Custom somedata": "Custom",
|
|
"Basic ": "Basic",
|
|
"InvalidHeader": "",
|
|
"": "",
|
|
" Bearer token": "", // cut at the first space yields an empty scheme
|
|
}
|
|
for header, want := range cases {
|
|
eq(t, ExtractAuthType(header), want, fmt.Sprintf("header %q", header))
|
|
}
|
|
}
|
|
|
|
func FuzzParseBasicAuth(f *testing.F) {
|
|
f.Add(basicHeader("user:pass"))
|
|
f.Add("Basic ")
|
|
f.Add("")
|
|
f.Add("Basic !!!")
|
|
|
|
f.Fuzz(func(t *testing.T, header string) {
|
|
username, password, err := ParseBasicAuth(header)
|
|
if err != nil {
|
|
if username != "" || password != "" {
|
|
t.Fatal("values returned alongside error")
|
|
}
|
|
return
|
|
}
|
|
encoded, ok := strings.CutPrefix(header, "Basic ")
|
|
if !ok {
|
|
t.Fatal("accepted a header without the Basic prefix")
|
|
}
|
|
decoded, decErr := base64.StdEncoding.DecodeString(encoded)
|
|
if decErr != nil {
|
|
t.Fatal("accepted an undecodable payload")
|
|
}
|
|
if string(decoded) != username+":"+password {
|
|
t.Fatalf("lossy split: %q vs %q", decoded, username+":"+password)
|
|
}
|
|
})
|
|
}
|